Tech

Hackers exploited iOS and Android flaws to infect phones

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 05/11/2026, 14:58:25 UTC.

Briefings

Hackers linked to Russia's Foreign Intelligence Service exploited patched iOS and Android vulnerabilities to infiltrate visitors of multiple websites, including one hosting the 250th anniversary of American independence. The attacks began when users visited potentially hundreds of sites, where JavaScript injected into traffic profiled devices and attempted to steal cookies, Wi-Fi passwords, and full mobile data. The imposter site america250.holiday served as a reverse proxy for the real site, delivering content while embedding malicious scripts. Researchers assessed the attackers with moderate to high confidence.

Key points

• Hackers linked to Russia's Foreign Intelligence Service exploited previously patched iOS and Android flaws to infiltrate visitors of multiple websites.
• The attacks began when iPhone or Android users visited one of potentially hundreds of different sites, where JavaScript injected into the traffic profiled the device.

Context

Researchers assessed the attackers with moderate to high confidence and identified them as part of Russia's Foreign Intelligence Service. The attacks targeted other sites, many with links to Russia's ongoing war against Ukraine. The imposter website america250.holiday served as a reverse proxy for america250.org, delivering content from the real site while adding malicious JavaScript. This finding matters because it demonstrates how targeted social engineering can bypass security patches to harvest sensitive data across diverse platforms.

Limitations

Evidence is limited to a single incident involving potentially hundreds of sites. The specific number of sites targeted is unknown, and the exact scope of data theft varies by platform. The timeline of the attack is not fully established, and the precise number of compromised devices remains unverified.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 05/11/2026, 18:21:47 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeicaaigz3uajb2rzed7nkjeax43ofhpjrpmdg753osy7nuyshc65qy